7 ms·

Well - to be fair, BBM over BES is as secure as it gets. The only people who can read those messages are sender and recipient, and the owner of the org keys.

Well - to be fair, BBM over BES is as secure as it gets. The only people who can read those messages are sender and recipient, and the owner of the org keys. Neither cell provider nor blackberry can decrypt them.

privong 13y ago
I think it's established that there are backdoors in BBM. E.g., http://www.zdnet.com/in/indias-blackberry-monitoring-system-ready-for-use-7000017937/ http://www.zdnet.com/in/indias-blackberry-monitoring-system-...
- deleted 13y ago
  [deleted]
- deleted 13y ago
  [deleted]
StavrosK 13y ago
How does it exchange the keys? If you don't verify fingerprints, there's always the possibility of a MITM.
- shasta 13y ago
  You can arrange a chat protocol, I think, where MITM isn't possible without being easily detectable in a low latency environment. The idea would be that when you see the "..." of the other person typing, you're receiving an encrypted copy of the letters of their message. When the message comes through it contains information needed to decrypt the message that was received over many seconds. You could always be chatting with an imposter, but a middle man would have to wait for the decrypted message before sending out the re-encrypted keys, which would add a big awkward pause before every response even started being typed.
  - StavrosK 13y ago
    Hmm, interesting idea, thanks. EDIT: I found the flaw: You have to wait until you have a full block before you can encrypt. If you send that, it's immediately decryptable. You can't send half a block, because you don't know the rest. Besides, the MITM can just pretend you haven't been typing until they receive the full message, and then start sending it.
    - mkup 13y ago
      Another interesting idea against MitM attacks on key exchange is implemented in ZRTP: verbal cross-check of two code words displayed on both terminals (during the first call) and key continuity (during subsequent calls). http://en.wikipedia.org/wiki/ZRTP#Authentication http://en.wikipedia.org/wiki/ZRTP#Authentication Cross-check of code words is essentially a humanization of RSA keys fingerprint cross-check. Only true geeks will speak hex digits over the phone, but normal people won't hesitate to tell a few words or small quizes/stories/whatever (if they need added security for this call).
      - StavrosK 13y ago
        The brilliant part of ZRTP isn't the cross check, it's using hash commitment to shorten the SAS to only 16 bits, from 160+. By the way, if anyone knows how a birthday attack is possible on the verification without hash commitment? It seems to me that the attacker has to generate a key whose fingerprint matches the fingerprint of the key they agreed on with the second recipient. However, this means that they have to generate a key to match a specific one, rather than multiple keys, hence no birthday attack is possible. What am I missing?
    - shasta 13y ago
      I don't understand the first flaw you found. You can encrypt single characters + salt. You are correct that the MITM could wait until it's seen the whole block and pretend your partner hasn't started typing, but that results in big pauses with no typing after every question, which is detectable.
X-Istence 13y ago
How does the key exchange happen between the two parties? With a party in the middle that has an already existing relationship with both parties, no? That is where you sit and exchange fake data with both endpoints.
- jtgeibel 13y ago
  With enterprise server (BES) presumably the company which owns the phone acts as the certificate authority. So your employer could pull off a MITM attack, but then they already own the hardware anyway.
  - est 13y ago
    Yeah like Apple makes your iPhone hardware anyway.
    - GrinningFool 13y ago
      Except that this would have to be done at each individual company...
CrankyPants 13y ago
Leaders from Saudi Arabia, India, and probably the UAE, Lebanon, Algeria and others all disagree with you on this one.
- bryanlarsen 13y ago
  No contradiction. The telcos are the owners of the org keys. Bbm is only secure if you run your own bes.
- GrinningFool 13y ago
  Incorrect. They have access to consumer level, same as any other nation that permits BBM. There is no access to BES - it's a private key owned by the companies.
alecsmart1 13y ago
As far as I know, the Indian govenrment gave an ultimatum to BlackBerry to place servers in India and provide a mechanism to read messages or to leave the country. BlackBerry caved in and was forced to do so. So even BBM isn't as secure. Anytime you trust a third party with your data, there is always that element of risk involved.
- GrinningFool 13y ago
  That was for BIS - consumer-level BBM, essentially, and the same access is given (if not advertise) to governments anywhere. Nobody has access to BBM over BES except each company running BES.
Spooky23 13y ago
Note that BES communications are only secure within a community of interest. (Assuming whomever is running your BES isn't logging and transmitting your texts) Once you talk to someone outside of your BES, RIM controls the key.

privong 13y ago

I think it's established that there are backdoors in BBM. E.g., http://www.zdnet.com/in/indias-blackberry-monitoring-system-ready-for-use-7000017937/ http://www.zdnet.com/in/indias-blackberry-monitoring-system-...

deleted 13y ago
[deleted]
deleted 13y ago
[deleted]

StavrosK 13y ago

How does it exchange the keys? If you don't verify fingerprints, there's always the possibility of a MITM.

shasta 13y ago
You can arrange a chat protocol, I think, where MITM isn't possible without being easily detectable in a low latency environment. The idea would be that when you see the "..." of the other person typing, you're receiving an encrypted copy of the letters of their message. When the message comes through it contains information needed to decrypt the message that was received over many seconds. You could always be chatting with an imposter, but a middle man would have to wait for the decrypted message before sending out the re-encrypted keys, which would add a big awkward pause before every response even started being typed.
- StavrosK 13y ago
  Hmm, interesting idea, thanks. EDIT: I found the flaw: You have to wait until you have a full block before you can encrypt. If you send that, it's immediately decryptable. You can't send half a block, because you don't know the rest. Besides, the MITM can just pretend you haven't been typing until they receive the full message, and then start sending it.
  - mkup 13y ago
    Another interesting idea against MitM attacks on key exchange is implemented in ZRTP: verbal cross-check of two code words displayed on both terminals (during the first call) and key continuity (during subsequent calls). http://en.wikipedia.org/wiki/ZRTP#Authentication http://en.wikipedia.org/wiki/ZRTP#Authentication Cross-check of code words is essentially a humanization of RSA keys fingerprint cross-check. Only true geeks will speak hex digits over the phone, but normal people won't hesitate to tell a few words or small quizes/stories/whatever (if they need added security for this call).
    - StavrosK 13y ago
      The brilliant part of ZRTP isn't the cross check, it's using hash commitment to shorten the SAS to only 16 bits, from 160+. By the way, if anyone knows how a birthday attack is possible on the verification without hash commitment? It seems to me that the attacker has to generate a key whose fingerprint matches the fingerprint of the key they agreed on with the second recipient. However, this means that they have to generate a key to match a specific one, rather than multiple keys, hence no birthday attack is possible. What am I missing?
  - shasta 13y ago
    I don't understand the first flaw you found. You can encrypt single characters + salt. You are correct that the MITM could wait until it's seen the whole block and pretend your partner hasn't started typing, but that results in big pauses with no typing after every question, which is detectable.

X-Istence 13y ago

How does the key exchange happen between the two parties? With a party in the middle that has an already existing relationship with both parties, no? That is where you sit and exchange fake data with both endpoints.

jtgeibel 13y ago
With enterprise server (BES) presumably the company which owns the phone acts as the certificate authority. So your employer could pull off a MITM attack, but then they already own the hardware anyway.
- est 13y ago
  Yeah like Apple makes your iPhone hardware anyway.
  - GrinningFool 13y ago
    Except that this would have to be done at each individual company...

CrankyPants 13y ago

Leaders from Saudi Arabia, India, and probably the UAE, Lebanon, Algeria and others all disagree with you on this one.

bryanlarsen 13y ago
No contradiction. The telcos are the owners of the org keys. Bbm is only secure if you run your own bes.
GrinningFool 13y ago
Incorrect. They have access to consumer level, same as any other nation that permits BBM. There is no access to BES - it's a private key owned by the companies.

alecsmart1 13y ago

As far as I know, the Indian govenrment gave an ultimatum to BlackBerry to place servers in India and provide a mechanism to read messages or to leave the country. BlackBerry caved in and was forced to do so. So even BBM isn't as secure. Anytime you trust a third party with your data, there is always that element of risk involved.

GrinningFool 13y ago
That was for BIS - consumer-level BBM, essentially, and the same access is given (if not advertise) to governments anywhere. Nobody has access to BBM over BES except each company running BES.

Spooky23 13y ago

Note that BES communications are only secure within a community of interest. (Assuming whomever is running your BES isn't logging and transmitting your texts) Once you talk to someone outside of your BES, RIM controls the key.